Apache Kafka Array Pre-allocation Vulnerability Exposes Risk to Unauthenticated Attackers

CVE-2026-111108

What is CVE-2026-111108?

In Apache Kafka, a vulnerability exists due to improperly handled array pre-sizing in code-generated protocol readers. This flaw allows attackers—especially on unauthenticated listeners—to exploit the system by declaring a fictitiously large array length in requests. Since the system only checks available bytes in the buffer against the declared count, it enables the potential of crashing the broker through substantial memory allocation, leading to performance degradation or downtime. Additionally, even on secured listeners, if an attacker possesses valid credentials, they can abuse this vulnerability as request parsing occurs before any authorization checks.

References